attocode-code-intel 0.1.0__py3-none-any.whl

attocode_intel/rules/packs/examples/go/manifest.yaml

@@ -0,0 +1,4 @@
+name: go
+version: 1.0.0
+languages: [go]
+description: "Go analysis pack — performance antipatterns (PerfInsights-inspired), correctness, security, and idiomatic Go patterns"

attocode_intel/rules/packs/examples/go/rules/performance.yaml

@@ -0,0 +1,136 @@
+# Go performance antipatterns — inspired by Uber PerfInsights
+# These target patterns that cause measurable CPU/memory overhead
+# in production Go services.
+
+- id: go-sprintf-allocation
+  name: fmt.Sprintf string allocation
+  pattern: 'fmt\.Sprintf\s*\('
+  message: "fmt.Sprintf allocates a new string per call — consider alternatives in hot paths"
+  severity: low
+  category: performance
+  languages: [go]
+  confidence: 0.5
+  explanation: >
+    fmt.Sprintf parses the format string and allocates a new string on every
+    invocation. In hot loops, this creates N allocations that pressure the GC.
+    Not every Sprintf is a problem — only flag this in performance-sensitive paths.
+  recommendation: "For hot paths, use strings.Builder, strconv.Itoa + concatenation, or pre-allocate"
+  examples:
+    - bad: 'key := fmt.Sprintf("cache:%s:%d", prefix, id)'
+      good: 'key := "cache:" + prefix + ":" + strconv.Itoa(id)'
+      explanation: "String concatenation avoids format parsing overhead"
+    - bad: 'msg := fmt.Sprintf("error: %s", err.Error())'
+      good: 'msg := "error: " + err.Error()'
+      explanation: "Direct concatenation for simple cases"
+
+- id: go-string-tolower-compare
+  name: strings.ToLower for comparison
+  pattern: 'strings\.To(?:Lower|Upper)\s*\([^)]+\)\s*[!=]='
+  message: "strings.ToLower() allocates a new string for comparison — use EqualFold"
+  severity: medium
+  category: performance
+  languages: [go]
+  confidence: 0.85
+  explanation: >
+    strings.ToLower() creates a new lowercase copy of the string just to
+    compare it. strings.EqualFold() compares case-insensitively without
+    any allocation.
+  recommendation: "Use strings.EqualFold(a, b) for case-insensitive comparison"
+  examples:
+    - bad: 'if strings.ToLower(name) == "admin" {'
+      good: 'if strings.EqualFold(name, "admin") {'
+      explanation: "EqualFold is allocation-free"
+
+- id: go-append-no-prealloc
+  name: append without pre-allocation
+  pattern: 'var\s+\w+\s+\[\]\w+\s*\n(?:.*\n){0,5}.*\bappend\('
+  message: "Slice append in loop without pre-allocation causes repeated re-allocation"
+  severity: low
+  category: performance
+  languages: [go]
+  confidence: 0.5
+  explanation: >
+    When the final size is known or estimatable, pre-allocating with
+    make([]T, 0, n) avoids the geometric growth and copying that
+    append performs behind the scenes.
+  recommendation: "Use make([]T, 0, expectedLen) when the size is known"
+  examples:
+    - bad: "var results []string\nfor _, item := range items {\n    results = append(results, item.Name)\n}"
+      good: "results := make([]string, 0, len(items))\nfor _, item := range items {\n    results = append(results, item.Name)\n}"
+      explanation: "Pre-allocation avoids re-allocation during growth"
+
+- id: go-json-marshal-hot
+  name: json.Marshal without reusable encoder
+  pattern: 'json\.(?:Marshal|MarshalIndent|Unmarshal)\s*\('
+  message: "json.Marshal/Unmarshal in hot path — consider json.NewEncoder for reuse"
+  severity: low
+  category: performance
+  languages: [go]
+  confidence: 0.5
+  explanation: >
+    json.Marshal creates a new encoder internally each time. For high-throughput
+    paths, reusing json.NewEncoder with a bytes.Buffer pool reduces allocations.
+  recommendation: "For hot paths, use json.NewEncoder(buf) with sync.Pool for buffers"
+
+- id: go-mutex-lock
+  name: sync.Mutex Lock call
+  pattern: '\.Lock\(\)'
+  message: "Mutex lock — verify no I/O (network, file, HTTP) happens before Unlock"
+  severity: info
+  category: suspicious
+  languages: [go]
+  confidence: 0.3
+  explanation: >
+    Holding a mutex across I/O blocks all waiting goroutines. This flags
+    Lock() calls for review — check that no network calls, file operations,
+    or HTTP requests occur before the corresponding Unlock().
+  recommendation: "Verify no I/O between Lock() and Unlock(). If there is, restructure."
+
+- id: go-reflect-in-loop
+  name: Reflection in tight loop
+  pattern: 'reflect\.(?:ValueOf|TypeOf)\s*\('
+  message: "reflect.ValueOf/TypeOf in potential hot path — reflection is slow"
+  severity: low
+  category: performance
+  languages: [go]
+  confidence: 0.45
+  explanation: >
+    Reflection in Go is significantly slower than direct type access due to
+    interface boxing and type introspection. In tight loops, this overhead
+    compounds.
+  recommendation: "Use type switches, generics, or code generation instead of reflection"
+
+- id: go-error-string-compare
+  name: Error string comparison
+  pattern: 'err\.Error\(\)\s*[!=]='
+  message: "Comparing error strings is fragile — use errors.Is or errors.As"
+  severity: medium
+  category: correctness
+  languages: [go]
+  confidence: 0.9
+  explanation: >
+    Error messages can change between library versions. errors.Is() and
+    errors.As() check the error chain properly and are stable across versions.
+  recommendation: "Use errors.Is(err, targetErr) or errors.As(err, &targetType)"
+  examples:
+    - bad: 'if err.Error() == "not found" {'
+      good: 'if errors.Is(err, ErrNotFound) {'
+      explanation: "errors.Is checks the entire error chain"
+
+- id: go-defer-statement
+  name: defer statement (check if inside loop)
+  pattern: '^\s+defer\s'
+  message: "defer call — if inside a loop, defers accumulate until function returns"
+  severity: low
+  category: correctness
+  languages: [go]
+  confidence: 0.35
+  explanation: >
+    If this defer is inside a for/range loop, deferred calls stack up until
+    the function returns — causing resource leaks. Check surrounding code
+    for a loop. If inside a loop, wrap in a closure or close explicitly.
+  recommendation: "If inside a loop: wrap in func() { defer f.Close() }()"
+  examples:
+    - bad: "for _, f := range files {\n    fd, _ := os.Open(f)\n    defer fd.Close()\n}"
+      good: "for _, f := range files {\n    func() {\n        fd, _ := os.Open(f)\n        defer fd.Close()\n    }()\n}"
+      explanation: "Closure ensures defer runs each iteration"

attocode_intel/rules/packs/examples/go/rules/security.yaml

@@ -0,0 +1,48 @@
+# Go security patterns
+
+- id: go-sql-string-concat
+  name: SQL string concatenation
+  pattern: '(?:db|tx|conn)\.(?:Query|QueryRow|QueryContext|QueryRowContext|Exec|ExecContext|Prepare)\s*\([^,)]*\+'
+  message: "SQL query built with string concatenation — SQL injection risk"
+  severity: high
+  category: security
+  languages: [go]
+  cwe: CWE-89
+  confidence: 0.8
+  recommendation: "Use parameterized queries with ? placeholders"
+  examples:
+    - bad: 'db.Query("SELECT * FROM users WHERE id=" + id)'
+      good: 'db.Query("SELECT * FROM users WHERE id=?", id)'
+
+- id: go-exec-command-var
+  name: Variable in exec.Command
+  pattern: 'exec\.Command\s*\([^"'']'
+  message: "exec.Command with variable argument — command injection risk"
+  severity: high
+  category: security
+  languages: [go]
+  cwe: CWE-78
+  confidence: 0.7
+  recommendation: "Validate and sanitize command arguments; avoid user input in commands"
+
+- id: go-template-html-unescaped
+  name: template.HTML with user input
+  pattern: 'template\.HTML\s*\('
+  message: "template.HTML bypasses Go's auto-escaping — XSS risk"
+  severity: medium
+  category: security
+  languages: [go]
+  cwe: CWE-79
+  confidence: 0.7
+  recommendation: "Use text/template auto-escaping; only use template.HTML for trusted content"
+
+- id: go-tls-insecure
+  name: TLS InsecureSkipVerify
+  pattern: 'InsecureSkipVerify\s*:\s*true'
+  message: "TLS certificate verification disabled — MITM risk"
+  severity: high
+  category: security
+  languages: [go]
+  cwe: CWE-295
+  confidence: 0.95
+  recommendation: "Enable TLS verification; use custom CA bundle if needed"

attocode_intel/rules/packs/examples/go/rules/structural.yaml

@@ -0,0 +1,58 @@
+# Go structural patterns (ast-grep, Tier 2).
+#
+# Many Go ``pkg.Func(arg)`` patterns are parsed by tree-sitter as
+# ``type_conversion_expression`` (treating ``pkg.Func`` as a qualified
+# type) rather than ``call_expression``. We disambiguate via
+# ``structural_context`` + ``structural_selector`` so the matcher binds
+# to the actual call.
+
+- id: go-debug-fmt-println
+  name: Debug fmt.Println left in source
+  structural_pattern: 'fmt.Println($X)'
+  structural_context: 'func _() { fmt.Println($X) }'
+  structural_selector: call_expression
+  message: "fmt.Println($X) left in source — switch to log.Printf or remove"
+  severity: low
+  category: style
+  languages: [go]
+  confidence: 0.35
+  tags: [debug]
+  explanation: >
+    ``fmt.Println`` writes straight to stdout with no level filtering or
+    structure. In services, prefer ``log`` / ``slog`` so output can be
+    routed and silenced.
+  recommendation: "Use log.Printf, slog.Info, or remove if it was a debug aid."
+  examples:
+    - bad: "fmt.Println(\"got request\", req)"
+      good: "slog.Info(\"got request\", \"req\", req)"
+      explanation: "Structured logging keeps fields queryable and respects levels."
+
+- id: go-production-panic
+  name: panic() in production code
+  structural_pattern: 'panic($X)'
+  message: "panic($X) — production code should return errors instead of crashing"
+  severity: medium
+  category: correctness
+  languages: [go]
+  confidence: 0.55
+  explanation: >
+    Go convention is to return ``error`` and let callers decide what to
+    do. ``panic`` is reserved for truly unrecoverable invariants (init
+    failures, programmer errors).
+  recommendation: "Return an error from the function and let the caller handle it."
+
+- id: go-blocking-sleep
+  name: Blocking time.Sleep call
+  structural_pattern: 'time.Sleep($X)'
+  structural_context: 'func _() { time.Sleep($X) }'
+  structural_selector: call_expression
+  message: "time.Sleep($X) blocks the goroutine — usually a workaround for a missing sync primitive"
+  severity: low
+  category: suspicious
+  languages: [go]
+  confidence: 0.45
+  explanation: >
+    Hardcoded sleeps are flaky in tests and waste latency in production.
+    Replace with channel/select waits, context deadlines, or proper
+    backoff with a ticker.
+  recommendation: "Use a ticker, context.WithTimeout, or a synchronization channel."

attocode_intel/rules/packs/examples/go/taint/sanitizers.yaml

@@ -0,0 +1,24 @@
+sanitizers:
+  - name: parameterized_query
+    patterns:
+      - 'db\.Query(?:Row|Context)?\(\s*(?:["`]|`)[^)]*\?\s*(?:["`]|`)\s*,'
+      - 'db\.Exec(?:Context)?\(\s*(?:["`]|`)[^)]*\?\s*(?:["`]|`)\s*,'
+    language: go
+
+  - name: html_escape
+    patterns:
+      - 'html\.EscapeString\('
+      - 'template\.HTMLEscapeString\('
+    language: go
+
+  - name: filepath_clean
+    patterns:
+      - 'filepath\.Clean\('
+      - 'filepath\.Base\('
+    language: go
+
+  - name: url_escape
+    patterns:
+      - 'url\.PathEscape\('
+      - 'url\.QueryEscape\('
+    language: go

attocode_intel/rules/packs/examples/go/taint/sinks.yaml

@@ -0,0 +1,51 @@
+sinks:
+  - name: sql_query
+    patterns:
+      - 'db\.Query\('
+      - 'db\.QueryRow\('
+      - 'db\.QueryContext\('
+      - 'db\.QueryRowContext\('
+      - 'db\.Exec\('
+      - 'db\.ExecContext\('
+      - 'tx\.Query\('
+      - 'tx\.QueryContext\('
+      - 'tx\.Exec\('
+      - 'tx\.ExecContext\('
+    cwe: CWE-89
+    message: "SQL injection: tainted data reaches database query"
+    language: go
+
+  - name: exec_command
+    patterns:
+      - 'exec\.Command\('
+      - 'exec\.CommandContext\('
+    cwe: CWE-78
+    message: "Command injection: tainted data reaches shell execution"
+    language: go
+
+  - name: template_html
+    patterns:
+      - 'template\.HTML\('
+      - 'template\.JS\('
+      - 'template\.URL\('
+    cwe: CWE-79
+    message: "XSS: tainted data passed to template.HTML (bypasses escaping)"
+    language: go
+
+  - name: file_access
+    patterns:
+      - 'os\.Open\('
+      - 'os\.Create\('
+      - 'os\.ReadFile\('
+      - 'os\.WriteFile\('
+      - 'filepath\.Join\('
+    cwe: CWE-22
+    message: "Path traversal: tainted data used in file path"
+    language: go
+
+  - name: http_redirect
+    patterns:
+      - 'http\.Redirect\('
+    cwe: CWE-601
+    message: "Open redirect: tainted data in redirect URL"
+    language: go

attocode_intel/rules/packs/examples/go/taint/sources.yaml

@@ -0,0 +1,26 @@
+sources:
+  - name: http_request
+    patterns:
+      - 'r\.URL\.Query\(\)'
+      - 'r\.FormValue\('
+      - 'r\.Body'
+      - 'r\.Header\.Get\('
+      - 'r\.PostFormValue\('
+      - 'r\.URL\.Path'
+      - 'r\.URL\.RawQuery'
+      - 'r\.Host'
+      - 'r\.Cookies?\('
+      - 'req\.(?:Body|URL|Header|Form|PostForm)'
+    language: go
+
+  - name: os_args
+    patterns:
+      - 'os\.Args'
+      - 'flag\.(?:String|Int|Bool|Float64|Duration|Var)\('
+    language: go
+
+  - name: env_var
+    patterns:
+      - 'os\.Getenv\('
+      - 'os\.LookupEnv\('
+    language: go

attocode_intel/rules/packs/examples/java/manifest.yaml

@@ -0,0 +1,4 @@
+name: java
+version: 1.0.0
+languages: [java, kotlin]
+description: "Java/Kotlin analysis pack — correctness, performance, security patterns"

attocode_intel/rules/packs/examples/java/rules/correctness.yaml

@@ -0,0 +1,55 @@
+# Java/Kotlin correctness and performance patterns
+
+- id: java-string-concat-loop
+  name: String concatenation in loop
+  pattern: '\w+\s*\+=\s*"'
+  message: "String concatenation in loop — O(N^2) due to immutable strings"
+  severity: medium
+  category: performance
+  languages: [java, kotlin]
+  confidence: 0.6
+  recommendation: "Use StringBuilder for loop concatenation"
+  examples:
+    - bad: 'String result = "";\nfor (String s : items) result += s;'
+      good: "StringBuilder sb = new StringBuilder();\nfor (String s : items) sb.append(s);"
+
+- id: java-catch-exception
+  name: Catch generic Exception
+  pattern: 'catch\s*\(\s*(?:Exception\s|\w+\s*:\s*Exception)'
+  message: "Catching generic Exception — too broad, may mask bugs"
+  severity: medium
+  category: correctness
+  languages: [java, kotlin]
+  confidence: 0.7
+  recommendation: "Catch specific exception types"
+
+- id: java-synchronized-block
+  name: Synchronized block (check for I/O inside)
+  pattern: 'synchronized\s*\('
+  message: "Synchronized block — verify no I/O (streams, sockets, HTTP) inside"
+  severity: info
+  category: performance
+  languages: [java]
+  confidence: 0.35
+  recommendation: "If I/O occurs inside, move it outside the synchronized block"
+
+- id: java-null-return
+  name: Returning null from collection method
+  pattern: 'return\s+null\s*;'
+  message: "Returning null — consider Optional or empty collection"
+  severity: low
+  category: style
+  languages: [java]
+  confidence: 0.4
+  recommendation: "Use Optional<T>, Collections.emptyList(), or throw an exception"
+
+- id: java-sql-concat
+  name: SQL string concatenation
+  pattern: '(?:createQuery|prepareStatement|executeQuery)\s*\([^)]*\+'
+  message: "SQL query built with concatenation — SQL injection risk"
+  severity: high
+  category: security
+  languages: [java, kotlin]
+  cwe: CWE-89
+  confidence: 0.8
+  recommendation: "Use PreparedStatement with parameterized queries"

attocode_intel/rules/packs/examples/java/rules/structural.yaml

@@ -0,0 +1,48 @@
+# Java structural patterns (ast-grep, Tier 2).
+
+- id: java-system-out-println
+  name: System.out.println left in source
+  structural_pattern: 'System.out.println($X)'
+  message: "System.out.println($X) — use a logger framework instead"
+  severity: low
+  category: style
+  languages: [java]
+  confidence: 0.35
+  tags: [debug]
+  explanation: >
+    Direct ``System.out`` writes bypass the logging pipeline (SLF4J,
+    Log4j, JUL). They aren't filterable by level or routable to log
+    aggregators.
+  recommendation: "Use SLF4J: logger.info(\"…\", arg) — or remove if it was debug output."
+
+- id: java-print-stack-trace
+  name: Throwable.printStackTrace() called
+  structural_pattern: '$E.printStackTrace()'
+  message: "$E.printStackTrace() — log the exception via your logger instead"
+  severity: medium
+  category: correctness
+  languages: [java]
+  confidence: 0.7
+  explanation: >
+    ``printStackTrace()`` writes to ``System.err`` with no metadata or
+    context. Logging frameworks attach timestamps, levels, MDC, and
+    can ship the trace alongside structured fields.
+  recommendation: "logger.error(\"context\", e) — passes the exception so the framework formats it."
+  examples:
+    - bad: "} catch (IOException e) {\n    e.printStackTrace();\n}"
+      good: "} catch (IOException e) {\n    logger.error(\"failed to read file\", e);\n}"
+      explanation: "The logger captures the full stack trace plus your message."
+
+- id: java-thread-sleep
+  name: Thread.sleep call
+  structural_pattern: 'Thread.sleep($X)'
+  message: "Thread.sleep($X) blocks the thread — usually a workaround for missing sync"
+  severity: low
+  category: suspicious
+  languages: [java]
+  confidence: 0.4
+  explanation: >
+    Hardcoded sleeps are flaky in tests and waste latency in services.
+    Prefer ``CompletableFuture``, ``CountDownLatch``, or scheduled
+    executors with proper retry/backoff.
+  recommendation: "Use CompletableFuture/CountDownLatch or a ScheduledExecutorService with backoff."

attocode_intel/rules/packs/examples/java/taint/sinks.yaml

@@ -0,0 +1,37 @@
+sinks:
+  - name: sql_query
+    patterns:
+      - 'createQuery\('
+      - 'prepareStatement\('
+      - 'executeQuery\('
+      - 'createNativeQuery\('
+    cwe: CWE-89
+    message: "SQL injection: tainted data reaches database query"
+    language: java
+
+  - name: runtime_exec
+    patterns:
+      - 'Runtime\.getRuntime\(\)\.exec\('
+      - 'ProcessBuilder\('
+    cwe: CWE-78
+    message: "Command injection: tainted data reaches process execution"
+    language: java
+
+  - name: file_access
+    patterns:
+      - 'new\s+File\('
+      - 'new\s+FileInputStream\('
+      - 'new\s+FileOutputStream\('
+      - 'Paths\.get\('
+      - 'Files\.readAllBytes\('
+    cwe: CWE-22
+    message: "Path traversal: tainted data used in file path"
+    language: java
+
+  - name: response_write
+    patterns:
+      - 'response\.getWriter\(\)\.(?:print|write)\('
+      - 'response\.getOutputStream\('
+    cwe: CWE-79
+    message: "XSS: tainted data written directly to HTTP response"
+    language: java

attocode_intel/rules/packs/examples/java/taint/sources.yaml

@@ -0,0 +1,21 @@
+sources:
+  - name: http_request
+    patterns:
+      - 'request\.getParameter\('
+      - 'request\.getHeader\('
+      - 'request\.getCookies\('
+      - 'request\.getQueryString\('
+      - 'request\.getPathInfo\('
+      - 'request\.getInputStream\('
+      - '@RequestParam'
+      - '@PathVariable'
+      - '@RequestBody'
+      - '@RequestHeader'
+    language: java
+
+  - name: system_input
+    patterns:
+      - 'System\.getenv\('
+      - 'System\.getProperty\('
+      - 'Scanner\(System\.in\)'
+    language: java

attocode_intel/rules/packs/examples/kotlin/manifest.yaml

@@ -0,0 +1,4 @@
+name: kotlin
+version: 1.0.0
+languages: [kotlin]
+description: "Kotlin analysis pack — null-safety pitfalls, Android idioms, coroutine misuse"

attocode_intel/rules/packs/examples/kotlin/rules/correctness.yaml

@@ -0,0 +1,50 @@
+# Kotlin correctness rules (Tier 1 regex).
+
+- id: kotlin-not-null-assertion
+  name: Non-null assertion operator (!!)
+  pattern: '\w+!!'
+  message: "!! throws NPE if null — use safe call (?.) or explicit check"
+  severity: medium
+  category: correctness
+  languages: [kotlin]
+  cwe: CWE-476
+  confidence: 0.5
+  explanation: >
+    The ``!!`` operator turns a nullable into a non-null at the cost
+    of a NullPointerException at runtime. Defeats Kotlin's null safety.
+    Acceptable only after a confirmed invariant (with a comment).
+  recommendation: "Use ?.let { ... }, ?: throw IllegalStateException(\"why\"), or pattern-match the nullable."
+
+- id: kotlin-runtime-exception-throw
+  name: throw RuntimeException — too generic
+  pattern: 'throw\s+RuntimeException\s*\('
+  message: "throw RuntimeException — use a more specific exception type"
+  severity: medium
+  category: correctness
+  languages: [kotlin]
+  confidence: 0.7
+  recommendation: "Throw IllegalStateException, IllegalArgumentException, or a domain-specific subclass."
+
+- id: kotlin-runblocking-in-coroutine
+  name: runBlocking inside a coroutine
+  pattern: '\brunBlocking\s*[\{\(]'
+  message: "runBlocking inside a coroutine blocks the dispatcher — usually a mistake"
+  severity: medium
+  category: correctness
+  languages: [kotlin]
+  confidence: 0.4
+  explanation: >
+    ``runBlocking`` blocks the current thread until the coroutine
+    completes. Inside another coroutine you usually want to ``await``
+    or ``async``-launch instead.
+  recommendation: "Use coroutineScope { ... } or async { ... }.await() inside coroutines."
+
+- id: kotlin-print-debug
+  name: println debug leftover
+  pattern: '\bprintln\s*\('
+  message: "println — debug leftover, route through Timber/SLF4J"
+  severity: low
+  category: style
+  languages: [kotlin]
+  confidence: 0.5
+  recommendation: "Use Timber.d(\"...\") on Android or your project's logger."

attocode_intel/rules/packs/examples/kotlin/rules/structural.yaml

@@ -0,0 +1,38 @@
+# Kotlin structural patterns (ast-grep, Tier 2).
+
+- id: kotlin-todo-call
+  name: TODO() call left in code
+  structural_pattern: 'TODO()'
+  message: "TODO() — throws NotImplementedError at runtime; finish the implementation"
+  severity: high
+  category: correctness
+  languages: [kotlin]
+  confidence: 0.9
+  explanation: >
+    ``TODO()`` is the placeholder for unfinished code; it throws
+    ``NotImplementedError`` when reached. Useful during scaffolding,
+    should not survive into mainline.
+  recommendation: "Implement the function or open a tracking issue and gate the path."
+
+- id: kotlin-system-out-println
+  name: System.out.println left in source
+  structural_pattern: 'System.out.println($X)'
+  message: "System.out.println($X) — use Timber/SLF4J or remove"
+  severity: low
+  category: style
+  languages: [kotlin]
+  confidence: 0.35
+  tags: [debug]
+  recommendation: "Use Timber.i(\"...\") on Android or the project's logger."
+
+- id: kotlin-empty-catch
+  name: Empty catch swallows exception
+  structural_pattern: 'catch ($E: $T) {}'
+  structural_context: 'fun _f() { try {} catch ($E: $T) {} }'
+  structural_selector: catch_block
+  message: "Empty catch block silently swallows exceptions — log or rethrow"
+  severity: medium
+  category: correctness
+  languages: [kotlin]
+  confidence: 0.85
+  recommendation: "Log via Timber.e(e, \"context\") or rethrow as a more meaningful exception."

attocode_intel/rules/packs/examples/php/manifest.yaml

@@ -0,0 +1,4 @@
+name: php
+version: 1.0.0
+languages: [php]
+description: "PHP analysis pack — XSS / SQLi / RCE patterns, deprecated APIs, idiomatic style"